chore(pr-agent): repoint the reusable pin to the fixed SHA by yakimoto · Pull Request #31 · wave-av/sdk-python

yakimoto · 2026-08-25T19:02:40Z

What this changes

Repoints this repo's pr-agent caller from a pinned SHA of
wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml to @main.

Why

The pinned SHA predates two fixes that are already merged on wave-foundationorigin/main:

ed47221e (2026-08-22) — honest failure classification; the lane had been reporting a rate limit
for causes that were not rate limits.
32af9cef (2026-08-24) — ports four fixes the public mirror received, including the per-attempt
timeout-minutes step budget.

Without the second one, a slow router call with auto_review and auto_improve both enabled can
consume the entire 15-minute job ceiling. GitHub renders that as cancelled, and the reusable's
bounded retry is structurally unable to catch it, because continue-on-error does not trap a
cancellation. The observable result is a review lane that looks configured and silently does not
run.

Evidence

Measured 2026-08-25 across the fleet, reading each repo's origin/main:

wiring	repos
`reusable-pr-agent.yml@main`	100
inline copies (bypass the reusable entirely)	20
stale pins missing both fixes	15

On the pull_request bucket, callers on stale pins cancelled far more often than callers on current
logic. claude-workstation (pinned 51be84ea) cancelled 19 of 24; wave-console (@main)
cancelled 1 of 8. That control is n=1 on the current-logic side and is corroboration rather than
proof — the mechanism above is what carries the finding.

Reproduce the caller inventory:

gh api repos/wave-av/<repo>/contents/.github/workflows/pr-agent.yml \
--jq '.content' | base64 -d | grep -oE 'reusable-pr-agent\.yml@[a-zA-Z0-9.]+'

Why `@main` and not a newer SHA

@main is what 100 of the fleet's callers already use, so this is the existing convention rather
than a new posture. The supply-chain argument for SHA-pinning is strong for third-party actions and
much weaker for a first-party reusable workflow inside the same org, which is why the fleet settled
where it did. Pinning to a fresh SHA would reintroduce exactly this drift the next time the lane is
fixed.

Blast radius

One line, in one workflow file. No change to triggers, concurrency, permissions, secrets, or any
job-level gate. If the lane misbehaves the revert is the same one line.

Verification

.github/workflows/pr-agent.yml parses as YAML after the change, and the diff is the pin line only.
Nothing here proves the lane now succeeds — that is only observable on the next pull_request run
after merge, and the receipt to look for is a review that either posts or ends with an explicit
timeout annotation, instead of a bare cancelled.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by Sourcery

Enhancements:

Update the reusable PR-agent workflow reference to the current fixed revision so the review lane receives the latest reliability and failure-reporting fixes.

Note

Low Risk
Single workflow reference bump with no application or secret changes; revert is the same one line if the lane misbehaves.

Overview
Updates the one-line pin in pr-agent.yml so this repo’s PR-agent job calls wave-av/wave-foundation’s reusable-pr-agent.yml at 4ac59c8c instead of 150ffae.

Triggers, concurrency, permissions, secrets, and job shape are unchanged—only the upstream reusable revision moves forward so CI picks up wave-foundation fixes (clearer failure classification and per-step timeout handling that avoid long runs ending as silent cancelled jobs).

^{Reviewed by Cursor Bugbot for commit 2755494. Bugbot is set up for automated code reviews on this repo. Configure here.}

@main

The pinned SHA predates ed47221e and 32af9cef, both already on wave-foundation origin/main. Without the per-attempt timeout budget from 32af9cef a slow review consumes the 15-minute job ceiling, which GitHub renders as `cancelled` and which continue-on-error structurally cannot trap — so the lane looks configured and silently does not run. 100 of the fleet's callers already use @main; this adopts that convention.

codeant-ai · 2026-08-25T19:02:44Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

qodo-code-review · 2026-08-25T19:02:45Z

ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing

sourcery-ai

Sorry @yakimoto, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 5 days and 4 hours by commenting @sourcery-ai review. Upgrade to get a review now.

coderabbitai · 2026-08-25T19:02:52Z

Warning

Review limit reached

Next included review available in 53 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 93 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a1431540-7cee-4852-a193-7873e5289b9c

📥 Commits

Reviewing files that changed from the base of the PR and between d90796c and 2755494.

📒 Files selected for processing (1)

.github/workflows/pr-agent.yml

_{Comment @coderabbitai help to get the list of available commands.}

cursor · 2026-08-25T19:02:53Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_afbeaa38-edc4-482c-9e70-e759dc843c17)

sourcery-ai · 2026-08-25T19:02:55Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the PR-agent reusable workflow reference from a stale SHA to @main, aligning this caller with the fleet convention and bringing in fixes for failure classification and per-attempt timeout handling while changing only one workflow line.

File-Level Changes

Change	Details	Files
Repoint the pull-request agent caller to the first-party reusable workflow's current main branch.	Replace the historical commit SHA with @main while preserving the existing workflow path, comment, and secret wiring. Leave triggers, concurrency, permissions, and job-level behavior unchanged.	`.github/workflows/pr-agent.yml`
Adopt the reusable workflow fixes that address misleading failures and whole-job cancellation during slow retries.	Pick up honest failure classification from the updated reusable workflow. Pick up per-attempt timeout budgeting so bounded retries cannot exhaust the 15-minute job ceiling without an explicit timeout result.	`.github/workflows/pr-agent.yml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

macroscopeapp · 2026-08-25T19:03:35Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — Although the diff is only a one-line SHA update and the author owns the workflow, the referenced revision introduces substantial PR-agent behavior changes, including dispatch routing, retries, timeout handling, and fork protection around secrets. The transitive workflow impact is significant enough to require human review.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

gitar-bot · 2026-08-25T19:04:08Z

Note

Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by September 1. Add seats for more headroom.
Learn more

Code Review✅ Approved

Updates the reusable pr-agent workflow reference to point directly at @main, ensuring the lane receives upstream failure classification and step timeout fixes. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Compact`
`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

@main

@main trips the fleet zizmor `unpinned-uses` ratchet (baseline 0): claude-workstation workflow-lint failed with "This PR ADDS a workflow-security finding". Pinning to 32af9cef — the last commit touching reusable-pr-agent.yml, and the one that ADDS the per-attempt timeout budget — keeps SHA-pinning intact while still carrying both fixes (ed47221e, 32af9cef) the previous pin lacked.

codeant-ai · 2026-08-25T19:41:53Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

cursor · 2026-08-25T19:41:56Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3033bb43-04c9-4dbe-a636-8393d0b05422)

@main

wave-foundation#1273 merged, which added a `lane version` step to the reusable that annotates the resolved lane SHA and warns when a caller pins behind 32af9cef. Bumping from 32af9cef to 4ac59c8c picks that up, so this caller lands current instead of one commit stale on merge. Still SHA-pinned — @main trips the zizmor unpinned-uses ratchet (baseline 0).

codeant-ai · 2026-08-25T21:07:29Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

cursor · 2026-08-25T21:07:34Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1838b1f7-c798-4090-b25a-bdc5d9aa9689)

sourcery-aiBot reviewed Aug 25, 2026
View reviewed changes

yakimoto changed the title ~~chore(pr-agent): repoint the reusable pin to @main~~chore(pr-agent): repoint the reusable pin to the fixed SHAAug 25, 2026

yakimoto enabled auto-merge August 25, 2026 21:07

Uh oh!

Conversation

yakimoto commented Aug 25, 2026• edited by cursor BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this changes

Why

Evidence

Why @main and not a newer SHA

Blast radius

Verification

Summary by Sourcery

Uh oh!

codeant-aiBot commented Aug 25, 2026

Uh oh!

qodo-code-reviewBot commented Aug 25, 2026

Uh oh!

sourcery-aiBot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitaiBot commented Aug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cursorBot commented Aug 25, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

sourcery-aiBot commented Aug 25, 2026

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

macroscopeappBot commented Aug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

gitar-botBot commented Aug 25, 2026

Uh oh!

codeant-aiBot commented Aug 25, 2026

Uh oh!

cursorBot commented Aug 25, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

codeant-aiBot commented Aug 25, 2026

Uh oh!

cursorBot commented Aug 25, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yakimoto commented Aug 25, 2026•
edited by cursor Bot
Loading

Why `@main` and not a newer SHA

coderabbitaiBot commented Aug 25, 2026•
edited
Loading

macroscopeappBot commented Aug 25, 2026•
edited
Loading